Exam Trap: FHRP Preemption Defaults

Preemption is the mechanism by which a router with a higher priority can take over the active (or master) role from a currently active router with a lower priority. In the context of First Hop Redundancy Protocols (HSRP, VRRP, GLBP), preemption determines whether a router that was previously the active router but lost the role (due to failure or manual priority change) can reclaim the role when it comes back online with a higher priority.

Without preemption, once a router becomes active, it remains active until it fails, regardless of priority changes. This is the default behavior for HSRP and GLBP. With preemption enabled, a higher-priority router can force a role change, which is the default behavior for VRRP.

Consider a network with two routers: R1 (priority 150) and R2 (priority 100). R1 is the active HSRP router. If R1 fails, R2 becomes active. When R1 recovers, it has priority 150, higher than R2's 100. Without preemption, R1 will not automatically become active again—R2 remains active. This might be desirable to avoid unnecessary traffic disruption. With preemption, R1 would immediately take over, causing a brief outage as the new active router sends gratuitous ARPs and updates the MAC address table.

In HSRP, preemption is DISABLED by default. This is a critical exam point. The default configuration for an HSRP group does not include the preempt command. Therefore, even if you set a higher priority on a router, it will not become active unless the current active router fails.

To enable preemption in HSRP, you add the preempt keyword under the interface configuration:

interface GigabitEthernet0/1
 standby 1 ip 192.168.1.1
 standby 1 priority 150
 standby 1 preempt

When preemption is enabled, the router with the highest priority will become active after a brief delay (default 0 seconds). You can optionally configure a delay using standby <group> preempt delay <seconds> to give the network time to stabilize.

VRRP has preemption ENABLED by default. This is a key difference from HSRP and a common exam trap. In VRRP, the router with the highest priority will always be the master, and it will preempt any lower-priority master that is currently active.

To disable preemption in VRRP, you use the no preempt command under the VRRP configuration:

interface GigabitEthernet0/1
 vrrp 1 ip 192.168.1.1
 vrrp 1 priority 150
 no preempt

Note: In VRRP, the priority command is used to set the priority (default 100), and preempt is enabled by default. Some IOS versions use vrrp 1 preempt to enable, but the default is enabled. Always check the running config.

GLBP (Gateway Load Balancing Protocol) also has preemption DISABLED by default for both the AVF (Active Virtual Forwarder) and AVG (Active Virtual Gateway) roles. GLBP uses a weighting system and preemption can be enabled with the preempt command under the GLBP configuration.

interface GigabitEthernet0/1
 glbp 1 ip 192.168.1.1
 glbp 1 priority 150
 glbp 1 preempt

GLBP preemption is similar to HSRP in that it is off by default. However, GLBP also has a weighting mechanism that can affect which router is AVF; preemption based on weight is separate.

To check preemption status, use the following show commands:

HSRP:

show standby

Example output:

GigabitEthernet0/1 - Group 1
  State is Active
    2 state changes, last state change 00:00:15
  Virtual IP address is 192.168.1.1
  Active virtual MAC address is 0000.0c07.ac01
  Local virtual MAC address is 0000.0c07.ac01 (v1 default)
  Hello time 3 sec, hold time 10 sec
  Next hello sent in 1.536 secs
  Preemption enabled
  Active router is local
  Standby router is 192.168.1.3, priority 100 (expires in 8.544 sec)
  Priority 150 (configured 150)
  Group name is "hsrp-Gi0/1-1" (default)

Look for "Preemption enabled" or "Preemption disabled".

VRRP:

show vrrp

Example output:

GigabitEthernet0/1 - Group 1
  State is Master
  Virtual IP address is 192.168.1.1
  Virtual MAC address is 0000.5e00.0101
  Advertisement interval is 1.000 sec
  Preemption enabled
  Priority is 150
  Master Router is 192.168.1.2 (local), priority is 150
  Master Advertisement interval is 1.000 sec
  Master Down interval is 3.609 sec

Look for "Preemption enabled" or "Preemption disabled".

GLBP:

show glbp

Example output:

GigabitEthernet0/1 - Group 1
  State is Active
    1 state change, last state change 00:00:20
  Virtual IP address is 192.168.1.1
  Hello time 3 sec, hold time 10 sec
  Next hello sent in 1.536 secs
  Preemption enabled
  Active is local
  Standby is 192.168.1.3, priority 100 (expires in 8.544 sec)
  Priority 150 (configured 150)
  Weighting 100 (configured 100), thresholds: lower 1, upper 100
  Load balancing: round-robin
  Group name is "glbp-Gi0/1-1" (default)

Preemption works hand-in-hand with priority. The router with the highest priority becomes active (or master) when preemption is enabled. If priorities are equal, the router with the highest IP address becomes active (a tiebreaker).

Timers also play a role: when a router with higher priority comes up, it waits for the hello and hold timers to expire before taking over. The preemption delay can be configured to wait additional time.

The most common exam trap is assuming that all FHRPs have the same default preemption behavior. Remember:

Another trap: some candidates think that setting a higher priority automatically causes preemption. It does not—preemption must be explicitly enabled (except in VRRP).

Also, note that in VRRP, if you disable preemption, the current master remains master even if a higher-priority router appears. This can be useful to prevent flapping.

In enterprise networks, FHRP preemption is a critical design decision. Consider a data center with two core switches running HSRP for default gateway redundancy. The primary switch has priority 150, the secondary has priority 100. Preemption is disabled by design. Why? Because if the primary switch fails and then recovers, it will not automatically reclaim the active role. This prevents a double failover event: the network already converged with the secondary as active; forcing a switch back could cause a brief outage as the MAC address table updates and ARP caches expire. In many production environments, stability is preferred over always having the highest-priority router active.

However, consider a scenario where the primary router has significantly more bandwidth or better hardware. In that case, enabling preemption ensures that the superior router is always active. For example, a branch office with a primary MPLS link and a backup LTE router. The primary router has priority 200, the backup 100. With preemption enabled, if the primary goes down and comes back, it will resume being the active gateway, ensuring optimal performance.

Another common deployment is in campus networks with GLBP. GLBP allows load balancing across multiple routers. Preemption is typically disabled to avoid constant role changes. But if you have a router with a higher weight (for GLBP AVF election), you might enable preemption based on weight to ensure that a more capable router handles more traffic.

Misconfiguration can cause flapping. For example, if VRRP is used with default preemption enabled and both routers have the same priority (100), the router with the higher IP becomes master. If that router fails and recovers, it will preempt the other, causing a brief outage. If this happens frequently, the network may experience instability. To avoid this, network engineers often disable preemption on VRRP or use a preemption delay.

Scale considerations: In large networks with many VLANs and HSRP groups, preemption delay is crucial. Without a delay, when a router reloads, it may try to become active for all groups simultaneously, causing a CPU spike and potential packet loss. A delay of 30-60 seconds is common to allow routing protocols to converge first.

Performance: Preemption itself has minimal overhead, but the resulting state change triggers gratuitous ARP, which can impact switches and hosts. In networks with thousands of hosts, a single preemption event can cause a burst of ARP traffic.